@sweny-ai/core 0.1.38 → 0.1.40

package/dist/__tests__/skills.test.js

@@ -8,7 +8,8 @@ import { slack } from "../skills/slack.js";
 import { sentry } from "../skills/sentry.js";
 import { datadog } from "../skills/datadog.js";
 import { notification } from "../skills/notification.js";
-import { loadCustomSkills, configuredSkills, createSkillMap } from "../skills/index.js";
+import { createSkillMap } from "../skills/index.js";
+import { loadCustomSkills, configuredSkills } from "../skills/custom-loader.js";
 // ─── Helpers ─────────────────────────────────────────────────────
 const mockCtx = (config = {}) => ({
     config,

package/dist/browser.d.ts

@@ -9,7 +9,7 @@ export type { Skill, SkillCategory, Tool, ToolContext, ConfigField, JSONSchema,
 export { consoleLogger } from "./types.js";
 export { execute } from "./executor.js";
 export type { ExecuteOptions } from "./executor.js";
-export { github, linear, slack, sentry, datadog, notification, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredSkills, validateWorkflowSkills, } from "./skills/index.js";
+export { github, linear, slack, sentry, datadog, notification, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredBuiltinSkills, validateWorkflowSkills, } from "./skills/index.js";
 export type { SkillValidationResult } from "./skills/index.js";
 export { workflowZ, nodeZ, edgeZ, skillZ, parseWorkflow, validateWorkflow, workflowJsonSchema } from "./schema.js";
 export type { WorkflowError } from "./schema.js";

package/dist/browser.js

@@ -8,8 +8,8 @@
 export { consoleLogger } from "./types.js";
 // Executor
 export { execute } from "./executor.js";
-// Skills
-export { github, linear, slack, sentry, datadog, notification, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredSkills, validateWorkflowSkills, } from "./skills/index.js";
+// Skills (browser-safe — no filesystem access, no `process.env` reads)
+export { github, linear, slack, sentry, datadog, notification, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredBuiltinSkills, validateWorkflowSkills, } from "./skills/index.js";
 // Schema & validation
 export { workflowZ, nodeZ, edgeZ, skillZ, parseWorkflow, validateWorkflow, workflowJsonSchema } from "./schema.js";
 // Studio adapter

package/dist/cli/e2e.js

@@ -11,7 +11,8 @@ import chalk from "chalk";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { execute } from "../executor.js";
 import { ClaudeClient } from "../claude.js";
-import { createSkillMap, configuredSkills } from "../skills/index.js";
+import { createSkillMap } from "../skills/index.js";
+import { configuredSkills } from "../skills/custom-loader.js";
 import { consoleLogger } from "../types.js";
 import { validateWorkflow } from "../schema.js";
 // ── Template variable resolution ───────────────────────────────────────

package/dist/cli/main.js

@@ -10,8 +10,9 @@ import { execute } from "../executor.js";
 import { triageWorkflow, implementWorkflow, seedContentWorkflow } from "../workflows/index.js";
 import { consoleLogger } from "../types.js";
 import { ClaudeClient } from "../claude.js";
-import { createSkillMap, configuredSkills } from "../skills/index.js";
-import { buildAutoMcpServers, buildProviderContext } from "../mcp.js";
+import { createSkillMap, validateWorkflowSkills } from "../skills/index.js";
+import { configuredSkills } from "../skills/custom-loader.js";
+import { buildAutoMcpServers, buildSkillMcpServers, buildProviderContext } from "../mcp.js";
 import { loadAdditionalContext } from "../templates.js";
 import { validateWorkflow as validateWorkflowSchema } from "../schema.js";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
@@ -560,8 +561,40 @@ export async function workflowRunAction(file, options) {
     const isJson = Boolean(options.json);
     const isTTY = !isJson && (process.stderr.isTTY ?? false);
     const skills = createSkillMap(configuredSkills(process.env, process.cwd()));
-    const mcpAutoConfig = buildMcpAutoConfig(config);
-    const mcpServers = buildAutoMcpServers(mcpAutoConfig);
+    // Hard-fail at startup if the workflow references skills that aren't available.
+    // Each node lists alternatives by category (e.g. [sentry, datadog, betterstack]);
+    // we require at least one configured skill per category.
+    const validation = validateWorkflowSkills(workflow, skills);
+    if (validation.errors.length > 0) {
+        console.error(chalk.red(`\n  Workflow cannot run — missing required skills:\n`));
+        for (const err of validation.errors)
+            console.error(chalk.red(`    \u2717 ${err}`));
+        if (validation.missing.length > 0) {
+            console.error(chalk.dim(`\n  Set the missing env vars and try again:`));
+            for (const m of validation.missing) {
+                if (m.missingEnv.length > 0) {
+                    console.error(chalk.dim(`    - ${m.id}: ${m.missingEnv.join(", ")}`));
+                }
+            }
+        }
+        console.error("");
+        process.exit(1);
+        return;
+    }
+    for (const warn of validation.warnings)
+        console.error(chalk.yellow(`  \u26A0 ${warn}`));
+    // Engine-driven MCP wiring: only inject MCPs for skills that the workflow
+    // actually references AND whose env vars are present.
+    const referencedSkillIds = new Set();
+    for (const node of Object.values(workflow.nodes)) {
+        for (const id of node.skills)
+            referencedSkillIds.add(id);
+    }
+    const mcpServers = buildSkillMcpServers({
+        referencedSkills: referencedSkillIds,
+        credentials: buildCredentialMap(),
+        userMcpServers: Object.keys(config.mcpServers).length > 0 ? config.mcpServers : undefined,
+    });
     const claude = new ClaudeClient({
         maxTurns: config.maxInvestigateTurns || 50,
         cwd: process.cwd(),

package/dist/index.d.ts

@@ -27,8 +27,9 @@ export { execute } from "./executor.js";
 export type { ExecuteOptions } from "./executor.js";
 export { ClaudeClient } from "./claude.js";
 export type { ClaudeClientOptions } from "./claude.js";
-export { github, linear, slack, sentry, datadog, notification, supabase, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredSkills, validateWorkflowSkills, } from "./skills/index.js";
+export { github, linear, slack, sentry, datadog, notification, supabase, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredBuiltinSkills, validateWorkflowSkills, } from "./skills/index.js";
 export type { SkillValidationResult } from "./skills/index.js";
+export { loadCustomSkills, configuredSkills } from "./skills/custom-loader.js";
 export { workflowZ, nodeZ, edgeZ, skillZ, parseWorkflow, validateWorkflow, workflowJsonSchema } from "./schema.js";
 export type { WorkflowError } from "./schema.js";
 export { buildAutoMcpServers, buildProviderContext } from "./mcp.js";

package/dist/index.js

@@ -27,7 +27,9 @@ export { execute } from "./executor.js";
 // Claude client
 export { ClaudeClient } from "./claude.js";
 // Skills
-export { github, linear, slack, sentry, datadog, notification, supabase, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredSkills, validateWorkflowSkills, } from "./skills/index.js";
+export { github, linear, slack, sentry, datadog, notification, supabase, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredBuiltinSkills, validateWorkflowSkills, } from "./skills/index.js";
+// Node-only skill discovery (filesystem-based)
+export { loadCustomSkills, configuredSkills } from "./skills/custom-loader.js";
 // Schema & validation
 export { workflowZ, nodeZ, edgeZ, skillZ, parseWorkflow, validateWorkflow, workflowJsonSchema } from "./schema.js";
 // MCP auto-injection

package/dist/mcp.d.ts

@@ -1,4 +1,27 @@
 import type { McpAutoConfig, McpServerConfig } from "./types.js";
+export interface SkillMcpOptions {
+    /** Skill IDs referenced by the workflow being executed. Only these get MCPs. */
+    referencedSkills: Set<string>;
+    /** Flat credential map (env vars). MCPs are only wired when their creds are set. */
+    credentials: Record<string, string>;
+    /** User-supplied MCP servers — always win on key conflict. */
+    userMcpServers?: Record<string, McpServerConfig>;
+}
+/**
+ * Build MCP server configs for the skills a workflow references.
+ *
+ * For each skill ID in `referencedSkills`, look up its MCP wiring (if any)
+ * and include it only when the required credentials are present in `credentials`.
+ *
+ * Skills with no MCP variant (e.g. `notification`, `supabase`) are silently
+ * skipped — their in-process tools are wired separately by the executor.
+ *
+ * Unknown skill IDs (not built-in, not in this MCP catalog) are silently
+ * skipped here; the engine's hard-fail validation handles them upstream.
+ *
+ * User-supplied servers always win on key conflict.
+ */
+export declare function buildSkillMcpServers(opts: SkillMcpOptions): Record<string, McpServerConfig>;
 /**
  * Auto-configure well-known MCP servers based on which providers
  * and workspace tools the user has enabled.

package/dist/mcp.js

@@ -1,3 +1,163 @@
+/**
+ * Build MCP server configs for the skills a workflow references.
+ *
+ * For each skill ID in `referencedSkills`, look up its MCP wiring (if any)
+ * and include it only when the required credentials are present in `credentials`.
+ *
+ * Skills with no MCP variant (e.g. `notification`, `supabase`) are silently
+ * skipped — their in-process tools are wired separately by the executor.
+ *
+ * Unknown skill IDs (not built-in, not in this MCP catalog) are silently
+ * skipped here; the engine's hard-fail validation handles them upstream.
+ *
+ * User-supplied servers always win on key conflict.
+ */
+export function buildSkillMcpServers(opts) {
+    const auto = {};
+    const refs = opts.referencedSkills;
+    const creds = opts.credentials;
+    // GitHub MCP — wired when workflow uses `github` skill and a token is set.
+    if (refs.has("github") && creds.GITHUB_TOKEN) {
+        auto["github"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-github@latest"],
+            env: { GITHUB_PERSONAL_ACCESS_TOKEN: creds.GITHUB_TOKEN },
+        };
+    }
+    // GitLab MCP.
+    if (refs.has("gitlab") && creds.GITLAB_TOKEN) {
+        const env = { GITLAB_PERSONAL_ACCESS_TOKEN: creds.GITLAB_TOKEN };
+        const baseUrl = creds.GITLAB_URL || "https://gitlab.com";
+        if (baseUrl !== "https://gitlab.com")
+            env.GITLAB_API_URL = `${baseUrl}/api/v4`;
+        auto["gitlab"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-gitlab@latest"],
+            env,
+        };
+    }
+    // Linear MCP — official remote HTTP endpoint.
+    if (refs.has("linear") && creds.LINEAR_API_KEY) {
+        auto["linear"] = {
+            type: "http",
+            url: "https://mcp.linear.app/mcp",
+            headers: { Authorization: `Bearer ${creds.LINEAR_API_KEY}` },
+        };
+    }
+    // Jira / Confluence — needs all 3 creds.
+    if (refs.has("jira") && creds.JIRA_URL && creds.JIRA_EMAIL && creds.JIRA_API_TOKEN) {
+        auto["jira"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@sooperset/mcp-atlassian@latest"],
+            env: {
+                JIRA_URL: creds.JIRA_URL,
+                JIRA_EMAIL: creds.JIRA_EMAIL,
+                JIRA_API_TOKEN: creds.JIRA_API_TOKEN,
+            },
+        };
+    }
+    // Datadog MCP.
+    if (refs.has("datadog") && creds.DD_API_KEY && creds.DD_APP_KEY) {
+        auto["datadog"] = {
+            type: "http",
+            url: "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp",
+            headers: { DD_API_KEY: creds.DD_API_KEY, DD_APPLICATION_KEY: creds.DD_APP_KEY },
+        };
+    }
+    // Sentry MCP — server reads SENTRY_ACCESS_TOKEN, not SENTRY_AUTH_TOKEN.
+    if (refs.has("sentry") && creds.SENTRY_AUTH_TOKEN) {
+        const env = { SENTRY_ACCESS_TOKEN: creds.SENTRY_AUTH_TOKEN };
+        const sentryUrl = creds.SENTRY_URL;
+        if (sentryUrl && sentryUrl !== "https://sentry.io") {
+            try {
+                env.SENTRY_HOST = new URL(sentryUrl).hostname;
+            }
+            catch {
+                // malformed URL — leave SENTRY_HOST unset
+            }
+        }
+        auto["sentry"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@sentry/mcp-server@latest"],
+            env,
+        };
+    }
+    // New Relic MCP — region-aware HTTP endpoint, header is "Api-Key".
+    if (refs.has("newrelic") && creds.NEW_RELIC_API_KEY) {
+        const region = creds.NEW_RELIC_REGION;
+        const url = region === "eu" ? "https://mcp.eu.newrelic.com/mcp/" : "https://mcp.newrelic.com/mcp/";
+        auto["newrelic"] = {
+            type: "http",
+            url,
+            headers: { "Api-Key": creds.NEW_RELIC_API_KEY },
+        };
+    }
+    // BetterStack MCP — accept any of the legacy/telemetry/uptime tokens.
+    const bsToken = creds.BETTERSTACK_API_TOKEN || creds.BETTERSTACK_TELEMETRY_TOKEN || creds.BETTERSTACK_UPTIME_TOKEN;
+    if (refs.has("betterstack") && bsToken) {
+        auto["betterstack"] = {
+            type: "http",
+            url: "https://mcp.betterstack.com",
+            headers: { Authorization: `Bearer ${bsToken}` },
+        };
+    }
+    // Slack MCP — wired when workflow uses `slack` skill and bot token is set.
+    if (refs.has("slack") && creds.SLACK_BOT_TOKEN) {
+        const env = { SLACK_BOT_TOKEN: creds.SLACK_BOT_TOKEN };
+        if (creds.SLACK_TEAM_ID)
+            env.SLACK_TEAM_ID = creds.SLACK_TEAM_ID;
+        auto["slack"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-slack@latest"],
+            env,
+        };
+    }
+    // Notion MCP — accept either NOTION_TOKEN or NOTION_API_KEY.
+    if (refs.has("notion")) {
+        const token = creds.NOTION_TOKEN || creds.NOTION_API_KEY;
+        if (token) {
+            auto["notion"] = {
+                type: "stdio",
+                command: "npx",
+                args: ["-y", "@notionhq/notion-mcp-server@latest"],
+                env: { NOTION_TOKEN: token },
+            };
+        }
+    }
+    // PagerDuty MCP — auth scheme is `Token token=<key>`.
+    if (refs.has("pagerduty") && creds.PAGERDUTY_API_TOKEN) {
+        auto["pagerduty"] = {
+            type: "http",
+            url: "https://mcp.pagerduty.com/mcp",
+            headers: { Authorization: `Token token=${creds.PAGERDUTY_API_TOKEN}` },
+        };
+    }
+    // Monday.com MCP.
+    if (refs.has("monday") && creds.MONDAY_TOKEN) {
+        auto["monday"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@mondaydotcomorg/monday-api-mcp@latest"],
+            env: { MONDAY_TOKEN: creds.MONDAY_TOKEN },
+        };
+    }
+    // Asana MCP.
+    if (refs.has("asana") && creds.ASANA_ACCESS_TOKEN) {
+        auto["asana"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "asana-mcp@latest"],
+            env: { ASANA_ACCESS_TOKEN: creds.ASANA_ACCESS_TOKEN },
+        };
+    }
+    // User-supplied servers always win on key conflict.
+    return { ...auto, ...(opts.userMcpServers ?? {}) };
+}
 /**
  * Auto-configure well-known MCP servers based on which providers
  * and workspace tools the user has enabled.

package/dist/mcp.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { buildAutoMcpServers } from "./mcp.js";
+import { buildAutoMcpServers, buildSkillMcpServers } from "./mcp.js";
 // ─── Helpers ─────────────────────────────────────────────────────
 function cfg(overrides = {}) {
     return { credentials: {}, ...overrides };
@@ -345,3 +345,154 @@ describe("buildAutoMcpServers", () => {
         expect(result["slack"]).toBeUndefined();
     });
 });
+// ─── buildSkillMcpServers (engine-driven) ────────────────────────────
+describe("buildSkillMcpServers", () => {
+    it("returns empty when no skills referenced and no creds present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(),
+            credentials: {},
+        });
+        expect(result).toEqual({});
+    });
+    it("does not wire MCP for a skill not referenced by the workflow", () => {
+        // Token is set, but the workflow doesn't ask for github → no MCP.
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["linear"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc", LINEAR_API_KEY: "lin_abc" },
+        });
+        expect(result["github"]).toBeUndefined();
+        expect(result["linear"]).toBeDefined();
+    });
+    it("does not wire MCP for a referenced skill whose creds are missing", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github", "linear"]),
+            credentials: { LINEAR_API_KEY: "lin_abc" }, // no GITHUB_TOKEN
+        });
+        expect(result["github"]).toBeUndefined();
+        expect(result["linear"]).toBeDefined();
+    });
+    it("wires github MCP when referenced and GITHUB_TOKEN present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc" },
+        });
+        expect(result["github"]).toEqual({
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-github@latest"],
+            env: { GITHUB_PERSONAL_ACCESS_TOKEN: "ghp_abc" },
+        });
+    });
+    it("wires linear MCP when referenced and LINEAR_API_KEY present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["linear"]),
+            credentials: { LINEAR_API_KEY: "lin_abc" },
+        });
+        expect(result["linear"]).toEqual({
+            type: "http",
+            url: "https://mcp.linear.app/mcp",
+            headers: { Authorization: "Bearer lin_abc" },
+        });
+    });
+    it("wires sentry MCP with SENTRY_HOST for self-hosted SENTRY_URL", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["sentry"]),
+            credentials: { SENTRY_AUTH_TOKEN: "sntryu_abc", SENTRY_URL: "https://sentry.mycompany.com" },
+        });
+        expect(result["sentry"]?.env).toMatchObject({
+            SENTRY_ACCESS_TOKEN: "sntryu_abc",
+            SENTRY_HOST: "sentry.mycompany.com",
+        });
+    });
+    it("wires datadog MCP when both keys present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["datadog"]),
+            credentials: { DD_API_KEY: "dd_api", DD_APP_KEY: "dd_app" },
+        });
+        expect(result["datadog"]).toEqual({
+            type: "http",
+            url: "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp",
+            headers: { DD_API_KEY: "dd_api", DD_APPLICATION_KEY: "dd_app" },
+        });
+    });
+    it("does not wire datadog MCP when DD_APP_KEY is missing", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["datadog"]),
+            credentials: { DD_API_KEY: "dd_api" },
+        });
+        expect(result["datadog"]).toBeUndefined();
+    });
+    it("wires slack MCP without an opt-in flag — workflow reference is the opt-in", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["slack"]),
+            credentials: { SLACK_BOT_TOKEN: "xoxb-abc" },
+        });
+        expect(result["slack"]).toEqual({
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-slack@latest"],
+            env: { SLACK_BOT_TOKEN: "xoxb-abc" },
+        });
+    });
+    it("wires betterstack MCP only when the workflow references betterstack", () => {
+        // Token alone is not enough — must be referenced.
+        const noRef = buildSkillMcpServers({
+            referencedSkills: new Set(["sentry"]),
+            credentials: { BETTERSTACK_API_TOKEN: "bs_abc", SENTRY_AUTH_TOKEN: "sntry_x" },
+        });
+        expect(noRef["betterstack"]).toBeUndefined();
+        const withRef = buildSkillMcpServers({
+            referencedSkills: new Set(["betterstack"]),
+            credentials: { BETTERSTACK_API_TOKEN: "bs_abc" },
+        });
+        expect(withRef["betterstack"]).toEqual({
+            type: "http",
+            url: "https://mcp.betterstack.com",
+            headers: { Authorization: "Bearer bs_abc" },
+        });
+    });
+    it("user-supplied MCP servers win on key conflict", () => {
+        const custom = { type: "stdio", command: "my-github", args: [] };
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc" },
+            userMcpServers: { github: custom },
+        });
+        expect(result["github"]).toEqual(custom);
+    });
+    it("user-supplied servers can add MCPs alongside auto-wired ones", () => {
+        const my = { type: "http", url: "https://my.example.com" };
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc" },
+            userMcpServers: { "my-tool": my },
+        });
+        expect(result["github"]).toBeDefined();
+        expect(result["my-tool"]).toEqual(my);
+    });
+    it("silently skips skill IDs with no MCP catalog entry (e.g. notification)", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["notification", "supabase", "github"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc" },
+        });
+        expect(result["notification"]).toBeUndefined();
+        expect(result["supabase"]).toBeUndefined();
+        expect(result["github"]).toBeDefined();
+    });
+    it("wires multiple skills simultaneously", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github", "linear", "datadog", "slack"]),
+            credentials: {
+                GITHUB_TOKEN: "ghp_abc",
+                LINEAR_API_KEY: "lin_abc",
+                DD_API_KEY: "dd_api",
+                DD_APP_KEY: "dd_app",
+                SLACK_BOT_TOKEN: "xoxb-abc",
+            },
+        });
+        expect(result["github"]).toBeDefined();
+        expect(result["linear"]).toBeDefined();
+        expect(result["datadog"]).toBeDefined();
+        expect(result["slack"]).toBeDefined();
+    });
+});

package/dist/skills/custom-loader.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Custom skill discovery — Node-only.
+ *
+ * Lives outside `skills/index.ts` so the registry stays browser-safe. Anything
+ * that needs `node:fs` / `node:path` / `process.cwd()` belongs here.
+ */
+import type { Skill } from "../types.js";
+/**
+ * Load custom skills from a `.claude/skills/` directory.
+ *
+ * Custom skills are instruction-only (no tools or config) — they provide
+ * guidance documents that the coding agent reads from the filesystem.
+ * Registering them here ensures workflow validation recognises the skill IDs
+ * so nodes referencing them don't produce spurious warnings.
+ */
+export declare function loadCustomSkills(cwd?: string): Skill[];
+/**
+ * From all builtins + custom repo skills, return only the skills that are usable.
+ * Built-in skills are filtered by env vars; custom skills are always included.
+ *
+ * Node-only: reads `.claude/skills/` from disk. Browser code should call
+ * `configuredBuiltinSkills` from `@sweny-ai/core/browser` instead.
+ */
+export declare function configuredSkills(env?: Record<string, string | undefined>, cwd?: string): Skill[];

package/dist/skills/custom-loader.js

@@ -0,0 +1,88 @@
+/**
+ * Custom skill discovery — Node-only.
+ *
+ * Lives outside `skills/index.ts` so the registry stays browser-safe. Anything
+ * that needs `node:fs` / `node:path` / `process.cwd()` belongs here.
+ */
+import { readdirSync, readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import YAML from "yaml";
+import { builtinSkills, isSkillConfigured } from "./index.js";
+/**
+ * Load custom skills from a `.claude/skills/` directory.
+ *
+ * Custom skills are instruction-only (no tools or config) — they provide
+ * guidance documents that the coding agent reads from the filesystem.
+ * Registering them here ensures workflow validation recognises the skill IDs
+ * so nodes referencing them don't produce spurious warnings.
+ */
+export function loadCustomSkills(cwd = process.cwd()) {
+    const skillsDir = join(cwd, ".claude", "skills");
+    if (!existsSync(skillsDir))
+        return [];
+    const skills = [];
+    let entries;
+    try {
+        entries = readdirSync(skillsDir, { withFileTypes: true })
+            .filter((d) => d.isDirectory())
+            .map((d) => d.name);
+    }
+    catch {
+        return [];
+    }
+    for (const dirName of entries) {
+        const skillFile = join(skillsDir, dirName, "SKILL.md");
+        if (!existsSync(skillFile))
+            continue;
+        try {
+            const content = readFileSync(skillFile, "utf-8");
+            const frontmatter = parseFrontmatter(content);
+            if (!frontmatter?.name)
+                continue;
+            skills.push({
+                id: frontmatter.name,
+                name: frontmatter.name,
+                description: frontmatter.description ?? `Custom skill: ${frontmatter.name}`,
+                category: "general",
+                config: {},
+                tools: [],
+            });
+        }
+        catch {
+            // Skip malformed skill files
+        }
+    }
+    return skills;
+}
+/** Extract YAML frontmatter from a markdown file (between --- delimiters). */
+function parseFrontmatter(content) {
+    const match = content.match(/^---\s*\n([\s\S]*?)\n---/);
+    if (!match)
+        return null;
+    try {
+        return YAML.parse(match[1]);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * From all builtins + custom repo skills, return only the skills that are usable.
+ * Built-in skills are filtered by env vars; custom skills are always included.
+ *
+ * Node-only: reads `.claude/skills/` from disk. Browser code should call
+ * `configuredBuiltinSkills` from `@sweny-ai/core/browser` instead.
+ */
+export function configuredSkills(env = process.env, cwd) {
+    const configured = builtinSkills.filter((s) => isSkillConfigured(s, env));
+    const custom = loadCustomSkills(cwd);
+    // Deduplicate: built-in skills take precedence over custom skills with the same ID
+    const ids = new Set(configured.map((s) => s.id));
+    for (const skill of custom) {
+        if (!ids.has(skill.id)) {
+            configured.push(skill);
+            ids.add(skill.id);
+        }
+    }
+    return configured;
+}

package/dist/skills/index.d.ts

@@ -2,6 +2,10 @@
  * Skill Registry
  *
  * All built-in skills + helpers to build a skill map from config.
+ *
+ * This module is browser-safe — no `node:fs`, no `node:path`, no `process`.
+ * Custom skill discovery (filesystem-based) lives in `./custom-loader.js`,
+ * which is Node-only and re-exported from `@sweny-ai/core` (the Node entry).
  */
 import type { Skill, SkillCategory } from "../types.js";
 import { github } from "./github.js";
@@ -14,15 +18,6 @@ import { notification } from "./notification.js";
 import { supabase } from "./supabase.js";
 export declare const builtinSkills: Skill[];
 export { github, linear, slack, sentry, datadog, betterstack, notification, supabase };
-/**
- * Load custom skills from a `.claude/skills/` directory.
- *
- * Custom skills are instruction-only (no tools or config) — they provide
- * guidance documents that the coding agent reads from the filesystem.
- * Registering them here ensures workflow validation recognises the skill IDs
- * so nodes referencing them don't produce spurious warnings.
- */
-export declare function loadCustomSkills(cwd?: string): Skill[];
 /**
  * Build a skill map from an array of skills.
  * Pass to `execute()` as the `skills` option.
@@ -47,10 +42,13 @@ export declare function allSkills(): Map<string, Skill>;
  */
 export declare function isSkillConfigured(skill: Skill, env?: Record<string, string | undefined>): boolean;
 /**
- * From all builtins + custom repo skills, return only the skills that are usable.
- * Built-in skills are filtered by env vars; custom skills are always included.
+ * Browser-safe variant of `configuredSkills`: returns only the *built-in* skills
+ * whose required env vars are present. Does not touch the filesystem.
+ *
+ * Node callers should use `configuredSkills` from `@sweny-ai/core`, which also
+ * loads custom skills from `.claude/skills/`.
  */
-export declare function configuredSkills(env?: Record<string, string | undefined>, cwd?: string): Skill[];
+export declare function configuredBuiltinSkills(env?: Record<string, string | undefined>): Skill[];
 /**
  * Validate that a workflow's skill requirements are satisfiable.
  *

package/dist/skills/index.js

@@ -2,10 +2,11 @@
  * Skill Registry
  *
  * All built-in skills + helpers to build a skill map from config.
+ *
+ * This module is browser-safe — no `node:fs`, no `node:path`, no `process`.
+ * Custom skill discovery (filesystem-based) lives in `./custom-loader.js`,
+ * which is Node-only and re-exported from `@sweny-ai/core` (the Node entry).
  */
-import { readdirSync, readFileSync, existsSync } from "node:fs";
-import { join } from "node:path";
-import YAML from "yaml";
 import { github } from "./github.js";
 import { linear } from "./linear.js";
 import { slack } from "./slack.js";
@@ -17,65 +18,6 @@ import { supabase } from "./supabase.js";
 // ─── Built-in skill catalog ─────────────────────────────────────
 export const builtinSkills = [github, linear, slack, sentry, datadog, betterstack, notification, supabase];
 export { github, linear, slack, sentry, datadog, betterstack, notification, supabase };
-// ─── Custom skill discovery ─────────────────────────────────────
-/**
- * Load custom skills from a `.claude/skills/` directory.
- *
- * Custom skills are instruction-only (no tools or config) — they provide
- * guidance documents that the coding agent reads from the filesystem.
- * Registering them here ensures workflow validation recognises the skill IDs
- * so nodes referencing them don't produce spurious warnings.
- */
-export function loadCustomSkills(cwd = process.cwd()) {
-    const skillsDir = join(cwd, ".claude", "skills");
-    if (!existsSync(skillsDir))
-        return [];
-    const skills = [];
-    let entries;
-    try {
-        entries = readdirSync(skillsDir, { withFileTypes: true })
-            .filter((d) => d.isDirectory())
-            .map((d) => d.name);
-    }
-    catch {
-        return [];
-    }
-    for (const dirName of entries) {
-        const skillFile = join(skillsDir, dirName, "SKILL.md");
-        if (!existsSync(skillFile))
-            continue;
-        try {
-            const content = readFileSync(skillFile, "utf-8");
-            const frontmatter = parseFrontmatter(content);
-            if (!frontmatter?.name)
-                continue;
-            skills.push({
-                id: frontmatter.name,
-                name: frontmatter.name,
-                description: frontmatter.description ?? `Custom skill: ${frontmatter.name}`,
-                category: "general",
-                config: {},
-                tools: [],
-            });
-        }
-        catch {
-            // Skip malformed skill files
-        }
-    }
-    return skills;
-}
-/** Extract YAML frontmatter from a markdown file (between --- delimiters). */
-function parseFrontmatter(content) {
-    const match = content.match(/^---\s*\n([\s\S]*?)\n---/);
-    if (!match)
-        return null;
-    try {
-        return YAML.parse(match[1]);
-    }
-    catch {
-        return null;
-    }
-}
 // ─── Registry helpers ───────────────────────────────────────────
 /**
  * Build a skill map from an array of skills.
@@ -110,7 +52,7 @@ export function allSkills() {
  * Optional fields are validated by individual tool handlers at call time,
  * so missing optional config never disqualifies the skill.
  */
-export function isSkillConfigured(skill, env = process.env) {
+export function isSkillConfigured(skill, env = {}) {
     for (const field of Object.values(skill.config)) {
         if (field.required && field.env && !env[field.env])
             return false;
@@ -118,21 +60,14 @@ export function isSkillConfigured(skill, env = process.env) {
     return true;
 }
 /**
- * From all builtins + custom repo skills, return only the skills that are usable.
- * Built-in skills are filtered by env vars; custom skills are always included.
+ * Browser-safe variant of `configuredSkills`: returns only the *built-in* skills
+ * whose required env vars are present. Does not touch the filesystem.
+ *
+ * Node callers should use `configuredSkills` from `@sweny-ai/core`, which also
+ * loads custom skills from `.claude/skills/`.
  */
-export function configuredSkills(env = process.env, cwd) {
-    const configured = builtinSkills.filter((s) => isSkillConfigured(s, env));
-    const custom = loadCustomSkills(cwd);
-    // Deduplicate: built-in skills take precedence over custom skills with the same ID
-    const ids = new Set(configured.map((s) => s.id));
-    for (const skill of custom) {
-        if (!ids.has(skill.id)) {
-            configured.push(skill);
-            ids.add(skill.id);
-        }
-    }
-    return configured;
+export function configuredBuiltinSkills(env = {}) {
+    return builtinSkills.filter((s) => isSkillConfigured(s, env));
 }
 export function validateWorkflowSkills(workflow, available) {
     const configured = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"